CVE-2026-119757: LND Credentials Exposed in BTCPay

CVE-2026-119757 identifies an information disclosure vulnerability in BTCPay Server, the self-hosted Bitcoin payment processor. The flaw allows unauthenticated attackers to access and download the .macaroon credential files used by the Lightning Network Daemon (LND) node. All instances of BTCPay Server with versions before 2.4.2 are affected, including 2.4.2 release candidates.

The vulnerability carries a CVSS score of 9.8, classified as critical. Exposure of macaroon credentials enables attackers to gain full control of the connected LND node, including the ability to transfer funds without authorization. The vulnerability was officially published by NVD on November 5, 2026, and is already being discussed in security communities, with signals indicating high awareness in technical channels.

For administrators and IT teams: immediately verify the version of BTCPay Server in use. If it is prior to version 2.4.2, update without delay to the correct 2.4.2 release. It is advisable to review LND node logs and surrounding system logs to detect unauthorized access during the pre-update period. If the LND node has already been exposed, consider regenerating macaroon credentials and auditing transactions that occurred during the exposure window.